Unscored severity · published Jul 31, 2012
CVE-2012-3018
The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for…
–
CVSS
0.2%
EPSS
No
On KEV
Description
The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an authentication code, which allows local users to bypass intended access restrictions and obtain administrative access by predicting a challenge response.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Bizviz · Iconics
through 9.22; 8.05; 9.0; 9.01; 9.1; 9.2; +3 more · source: NVD
GE
Genesis32 · Iconics
through 9.22; 8.05; 9.0; 9.1; 9.01; 9.2; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3018
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3018
US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf
More from Bizviz
9.8
CVE-2020-12007
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability
9.8
CVE-2020-12011
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution
9.1
CVE-2020-12013
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely
7.5
CVE-2020-12015
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization
7.5
CVE-2020-12009
A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability